Popular TP-Link Tapo Cameras Patched To Prevent Unauthorised Local Access.

TL;DR

Before you orderOffer from Amazon

Get home appliances delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

TP-Link has released firmware updates for Tapo C200 and C120 cameras after researchers found a login bypass that could give someone on the same network administrator access. A separate flaw affecting the C200 could crash its HTTPS service or restart the device. The reported attacks require access to the camera’s local network, and owners need to install the latest firmware.

TP-Link has patched a login flaw in its Tapo C200 and C120 cameras that could let someone on the same network gain administrator access without a password. The updates also address a separate flaw that can disrupt the C200’s HTTPS service, according to the source report; the risks are limited to attackers who already have access to the household network or a trusted ecosystem.

Security firm OPSWAT discovered two vulnerabilities in the cameras. Its researchers, Khoi Tran and Thai Do, identified the more serious issue as CVE-2026-15315, which has a reported severity score of 8.7. The flaw affects the Tapo C200 series and also the Tapo C120, but TP-Link’s advisory identifies the C120’s V1 hardware version as affected.

The bypass is in the cameras’ HTTPS management interface. According to the researchers’ account, a second verification path accepts a value the camera provides during login as if it were a valid authentication response. A small number of requests can then produce an administrator session without a password or an existing session. That access could expose live video and stored recordings, or let an attacker change camera settings.

A second issue, CVE-2026-15316, carries a reported score of 7.1 and affects the C200 alone. OPSWAT said an oversized portion of encrypted Wi-Fi credential data can crash the HTTPS service or restart the device. TP-Link has issued firmware updates addressing both flaws. Owners should install the latest update for each affected camera; the source material does not specify version numbers.

Camera Access at Home

A camera administrator session can expose more than a device’s settings. It may provide access to live footage and stored recordings, making the vulnerability relevant to households that use cameras for indoor monitoring. OPSWAT said the stakes may be higher when a camera is used as a baby monitor, where the features at risk can include night vision, crying detection and two-way audio.

The local network requirement narrows who can carry out the reported attack: an attacker would first need access to the same Wi-Fi network or a trusted ecosystem. That limits the flaw’s reach compared with an attack that could be launched from anywhere online, but it does not remove the need to update cameras in affected hardware versions.

Two Flaws, Different Reach

The reported vulnerabilities affect the two camera models in different ways. CVE-2026-15315 is the login bypass and extends to the C120 V1 as well as the C200 series. CVE-2026-15316 is the C200-only crash flaw, involving encrypted Wi-Fi credential data and the HTTPS service.

The report describes both attacks as requiring an attacker to be on the same Wi-Fi network or within a trusted ecosystem first. It does not describe either flaw as remotely exploitable over the public internet without that access. The source material says TP-Link issued updates for both models to address the reported issues.

Details Still Unreported

The available source material does not identify the firmware version numbers that contain the fixes or give a release date. It also does not say how many devices may be affected, whether anyone exploited either vulnerability, or whether TP-Link has received reports of attacks.

The report provides details of the two vulnerabilities and the updates, but it does not establish whether every regional or hardware variant beyond those listed in the advisory is affected. For the C120, the stated scope is V1 hardware; owners with another hardware version may need to check TP-Link’s model-specific support information.

Owners Should Check Firmware

Owners of Tapo C200 and C120 cameras should check the device or TP-Link support page for the latest firmware and install the update for each camera. The source report does not provide a fixed version number, so the available update should be confirmed against the precise model and hardware version.

Further clarity may come from TP-Link’s advisory or later updates from the company and OPSWAT, including any additional hardware scope or exploitation reports. None is described in the source material at this time.

Key Questions

Which Tapo cameras are affected by the login bypass?

The reported bypass, CVE-2026-15315, affects the Tapo C200 series and the Tapo C120 V1 hardware version, according to the source report.

What could someone with administrator access do?

The flaw could expose live video and stored recordings and allow configuration changes. OPSWAT also described potential access to camera functions such as night vision and two-way audio.

Does the attack work from anywhere on the internet?

The reported attack requires access to the same Wi-Fi network or a trusted ecosystem. The source material does not describe it as an internet-based attack that needs no local access.

What is the separate C200 vulnerability?

CVE-2026-15316 affects the C200 alone. According to OPSWAT, oversized encrypted Wi-Fi credential data can crash the HTTPS service or restart the device.

What should owners do?

Install the latest firmware update for each affected camera, checking the exact model and hardware version. The source report does not list the fixed firmware version numbers.

Source: rss